Software Update - I got it working!

[Guest theeldergeek]

Many thanks to HodgeHi for a little tip he put my way in another thread namely some business videos.

 

Armed with that, and having come across one to do with Software Update, I thought I'd have a go. Never been able to get it to work before, that is, server downloads updates, client updates from server. Always had to go to each client and update from the web.

 

Anyway, I got it working, but not quite to my needs, so maybe someone can help me with taking it a touch further?

 

The server is downloading updates, I enable them, then I have to log into a client as the local admin, start Software Update and it looks to the server and tells me what is required. All well and good, I can install from there.

 

However, to do this, I have to log in as a local admin on each machine (which I can do via ARD) and instigate the process manually.

 

Is there any way I can force the machine to download the updates to itself, and install when I next log in as admin? For example, Windows will download the updates to a machine and will install when next prompted/allowed to do so.

 

Can the same process (or something similar) be applied to the Macs? OS is 10.5 on both clients and xserve.

 

However, what I want to avoid, is for my everyday users to not be hounded by "you have updates to install". I still want that to remain strictly an admin task. I just want to try and save a bit of time when I does come to me installing any updates, that they have already been downloaded to the machine, and are ready to be installed.

Edited May 18, 2010 by theeldergeek

[nicklec]

On 10.5 i've never got it to work myself, there is a command line tool but for me atleast running the command remotely it never finds updates unless an admin account is logged in anyway; does this ring any bells for anyone or is it flawed?

[HodgeHi]

Right. You will need to do a bit of tinkering first. Remotely log into all the clients as the local admin. Then use ARD to set the proxy settings (there is a command in the templates section in ARD) and also specify the excluded addresses if you need to for your update server.

 

Now this is done check to make sure that this account can see your server (run software update manually). If so good. Then log out.

Then using ARD you can do a number of things. I tend to just run softwareupdate -i -a. You need to specify the admin user when running the command.

 

This will list the updates for each machine and then download then and install them without any manual intervention. You should be able to all of the updates remotely without ever having to visit client. Occasionally though you may get some issues with some clients.

 

This how i set mine up.

[Guest theeldergeek]

Right. You will need to do a bit of tinkering first. Remotely log into all the clients as the local admin. Then use ARD to set the proxy settings (there is a command in the templates section in ARD) and also specify the excluded addresses if you need to for your update server.

 

Now this is done check to make sure that this account can see your server (run software update manually). If so good. Then log out.

Then using ARD you can do a number of things. I tend to just run softwareupdate -i -a. You need to specify the admin user when running the command.

 

This will list the updates for each machine and then download then and install them without any manual intervention. You should be able to all of the updates remotely without ever having to visit client. Occasionally though you may get some issues with some clients.

 

This how i set mine up.

 

I'll give it a go when the rooms are free

Thanks again.

[Guest theeldergeek]

Right. You will need to do a bit of tinkering first. Remotely log into all the clients as the local admin. Then use ARD to set the proxy settings (there is a command in the templates section in ARD) and also specify the excluded addresses if you need to for your update server

 

I'm using ARD > send UNIX - template > network setup > web proxy

 

In there, I can see the format I'd have to put (i'm using networksetup -setwebproxy proxy.name portnumber) but I can't see how I would specify excluded addresses?

 

If I could do this, it would save me quite a task of having to enter the excluded addresses in manually. There is one excluded address (namely our own domain) which is key to get it working.

 

If I enter the exclusion manually, SU works perfectly.

 

What I need to do is enter the exclusion in the UNIX part.

[nicklec]

Not had a chance to try this again myself but if you open a terminal and do networksetup --help you should get the command iirc its something like -setproxybypassdomains then your domains

[Guest theeldergeek]

Not had a chance to try this again myself but if you open a terminal and do networksetup --help you should get the command iirc its something like -setproxybypassdomains then your domains

 

Many thanks, that helped a lot.

 

I used ...

 

networksetup -setproxybypassdomains "Ethernet" (where Ethernet is the name of the built-in connection)

 

Worked like a charm.

Edited May 20, 2010 by theeldergeek

[HodgeHi]

There is a tips and tricks document found somewhere on the AFP548 website. IIRC in the back of this was a whole list of unix commands that are useful for ARD. You could get the commands by listing the man pages but you need to know the command first.

 

ARD coupled with the Unix commands is a very powerful tool for remote administration. Learn a bit of terminal and then you are pretty much unlimited to what can be done from ARD.

 

Also have a watch of the terminal tips video in the link I posted in the other thread. I thought it was a useful vid

[Arthur]

The following two blogs posts are worth a read since they contain quite a few SU tips...

 

http://managingosx.wordpress.com/2009/10/12/apple-software-update-options/

http://managingosx.wordpress.com/2009/01/06/firmware-updates/

[nibulon]

When i'm having to update a mac suite (10.5), as all clients are the same original image build and hardware type i sit at one, run software update locally on a client, select download packages only, copy them from the client (cant remember off top of my head where they get saved to) up onto the server and use ARD to push out the update packages as a remote install to the rest of the suite.

 

saves me logging into each machine and updates are still only downloaded the once, i keep them in a dated folder with the suite name for future reff also - not sure what would happen if an update was pushed out to a client and not required if it would force install it or not and cause a problem - but a bit of planning and checking and I've not had any problems doing this so far - not done this for a while though.

 

I kept the software update server pointing to an incorrect update source setting so the clients normally dont see any updates available to them and wont bug users with the 'update available for install' message on apps start up.

 

Just wish the Macs had a WSUS style arrangement, much better in my opinion.

 

Hope it helps

[HodgeHi]

I must say I'm a little confused about your comment. How does this make things easier? Surely if you don't want to deploy a package but still want to mirror it, you just disable that update on the software update server. You don't have to update the clients with the updates that your server has. You can choose which ones to deploy. Also once on your own SUS server you can deploy to clients a lot faster than you would be able to download them. Even if it is only once.

 

You could also stop the clients asking for the updates by unticking check for updates.

 

Or am I missing something? If so then please help clarify things for me. You may very well be onto something.

[Arthur]

You could also stop the clients asking for the updates by unticking check for updates.

This is what I do and it works really well.

 

The updates we don't want (like firmware updates which usually require user intervention) are deselected on the SUS.

[TomH]

Guys,

 

As above I specify the proxy and any bypass's that are required in WGM as well as the software update URL and then run the softwareupdate -i -a as root from remote desktop, works like a charm